Tech-invite 3GPPspace IETFspace

21 22 23 24 25 26 27 28 29 31 32 33 34 35 36 37 38 4‑5x

Content for TS 33.222 Word version: 17.2.0

0… 4…

4 Overview of the Security Architecture p. 8

5 Authentication schemes p. 9

5.1 Reference model p. 9

5.2 General requirements and principles p. 9

5.2.1 Requirements on the UE p. 9

5.2.2 Requirements on the NAF p. 9

5.3 Shared key-based UE authentication with certificate-based NAF authentication p. 10

5.3.0 Procedures |R11| p. 10

5.3.1 TLS profile p. 11

5.3.1.0 General |R11| p. 11

5.3.1.1 Protection mechanisms p. 12

5.3.1.2 Void

5.3.1.3 Authentication of the AP/AS p. 12

5.3.1.4 Authentication Failures p. 12

5.3.1.5 Set-up of Security parameters p. 12

5.3.1.6 Error cases p. 12

5.4 Shared key-based mutual authentication between UE and NAF p. 13

5.4.0 Procedures |R11| p. 13

5.4.0.0 General |R17| p. 13

5.4.0.1 TLS 1.2 |R17| p. 13

5.4.0.2 TLS 1.3 |R17| p. 14

5.4.1 TLS Profile p. 15

5.4.1.0 General |R11| p. 15

5.4.1.1 Protection mechanisms p. 16

5.4.1.2 Authentication of the AP/AS p. 16

5.4.1.3 Authentication Failures p. 16

5.4.1.4 Set-up of Security parameters p. 16

5.5 Certificate based mutual authentication between UE and application server p. 16

5.5.1 General |R7| p. 16

5.5.2 TLS Profile |R7| p. 16

5.5.2.1 General p. 16

5.5.2.2 Protection mechanisms p. 17

5.5.2.3 Void

6 Use of Authentication Proxy p. 18

6.1 Architectural view p. 18

6.2 Requirements and principles p. 19

6.4 Reference points p. 20

6.4.1 Ua reference point p. 20

6.4.2 AP-AS reference point p. 20

6.5 Management of UE identity p. 20

6.5.1 Granularity of Authentication and Access Control by AP p. 20

6.5.1.1 Authorised Participant of GBA p. 20

6.5.1.2 Authorised User of Application p. 21

6.5.2 Transfer of Asserted Identity from AP to AS p. 21

6.5.2.1 Authorised Participant of GBA p. 21

6.5.2.2 Authorised User of Application Anonymous to AS p. 21

6.5.2.3 Authorised User of Application with Transferred Identity asserted to AS p. 21

6.5.2.4 Authorised User of Application with Transferred Identity asserted to AS and Check of User Inserted Identity p. 22

A Technical Solutions for Access to Application Servers via Authentication Proxy and HTTPS p. 23

B Guidance on Certificate-based mutual authentication between UE and application server p. 24

C Considerations for GBA security using a web browser and Javascript |R12| p. 25

C.1 Usage Scenario p. 25

C.2 Threats p. 25

C.3 Control of GBA Credentials and GBA Module in the UE p. 26

C.3.1 General p. 26

C.3.2 Control Mechanism 1- Same Origin Authentication Tokens p. 26

C.3.3 Control Mechanism 2 - Server Authenticated TLS p. 26

C.3.4 Control Mechanism 3 - Channel Binding p. 26

C.3.5 Control Mechanism 4 - Key Usage p. 26

C.4 Security Considerations p. 27

C.4.1 General Scripting Security Considerations p. 27

C.4.2 GBA key control p. 27

C.4.3 User grants p. 27

C.4.4 Root CAs in Browser p. 27

D (Normative) Security measures for usage of GBA with a web browser |R12| p. 29

D.1 Extension of Protocol Mechanism used on Ua Reference Point p. 29

D.1.1 General p. 29

D.1.2 Key derivation p. 29

D.1.3 Channel binding p. 29

D.1.3.1 Background p. 29

D.1.3.2 Channel binding using RFC 5705 and RFC 5929 p. 30

D.2 Sequence flow p. 30

D.2.1 Sequence flow with channel binding p. 30

D.3 Javascript GBA API description p. 34

D.3.1 GBA API Description p. 34

D.3.2 API usage p. 35

$ Change history p. 36